{"kind": "product", "path": "vulns/ubuntu-14.04-lts/samba", "name": "samba", "product": "samba", "ecosystem": "Ubuntu:14.04:LTS", "items": [{"id": "CVE-2019-3880", "noindex": false, "published": "2019-04-09T15:18:08.000Z", "modified": "2024-08-04T19:19:18.589Z", "cvss": 4.2, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L", "severity": "medium", "epss": 0.0324, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2019-3880", "title": "CVE-2019-3880", "description": "A flaw was found in the way samba implemented an RPC endpoint emulating the Windows registry service API. An unprivileged attacker could use this flaw to create a new registry hive file anywhere they have unix permissions which could lead to creation of a new file in the Samba share. Versions before 4.8.11, 4.9.6 and 4.10.2 are vulnerable.", "references": ["https://www.samba.org/samba/security/CVE-2019-3880.html", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3880", "https://lists.debian.org/debian-lts-announce/2019/04/msg00013.html"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.20"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-16851", "noindex": false, "published": "2018-11-28T14:00:00.000Z", "modified": "2024-08-05T10:32:53.988Z", "cvss": 6.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.03251, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-16851", "title": "CVE-2018-16851", "description": "Samba from version 4.0.0 and before versions 4.7.12, 4.8.7, 4.9.3 is vulnerable to a denial of service. During the processing of an LDAP search before Samba's AD DC returns the LDAP entries to the client, the entries are cached in a single memory object with a maximum size of 256MB. When this size is reached, the Samba process providing the LDAP service will follow the NULL pointer, terminating the process. There is no further vulnerability associated with this issue, merely a denial of service.", "references": ["http://www.securityfocus.com/bid/106027", "https://usn.ubuntu.com/3827-2/", "https://usn.ubuntu.com/3827-1/"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.19"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-16841", "noindex": false, "published": "2018-11-28T14:00:00.000Z", "modified": "2024-08-05T10:32:54.002Z", "cvss": 5.7, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.04586, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-16841", "title": "CVE-2018-16841", "description": "Samba from version 4.3.0 and before versions 4.7.12, 4.8.7 and 4.9.3 are vulnerable to a denial of service. When configured to accept smart-card authentication, Samba's KDC will call talloc_free() twice on the same memory if the principal in a validly signed certificate does not match the principal in the AS-REQ. This is only possible after authentication with a trusted certificate. talloc is robust against further corruption from a double-free with talloc_free() and directly calls abort(), terminating the KDC process.", "references": ["http://www.securityfocus.com/bid/106023", "https://usn.ubuntu.com/3827-2/", "https://usn.ubuntu.com/3827-1/"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.19"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-14629", "noindex": false, "published": "2018-11-28T14:00:00.000Z", "modified": "2024-08-05T09:29:51.868Z", "cvss": 6.5, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.05192, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-14629", "title": "CVE-2018-14629", "description": "A denial of service vulnerability was discovered in Samba's LDAP server before versions 4.7.12, 4.8.7, and 4.9.3. A CNAME loop could lead to infinite recursion in the server. An unprivileged local attacker could create such an entry, leading to denial of service.", "references": ["https://usn.ubuntu.com/3827-2/", "https://usn.ubuntu.com/3827-1/", "http://www.securityfocus.com/bid/106022"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.19"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2016-2123", "noindex": false, "published": "2018-11-01T13:00:00.000Z", "modified": "2024-08-05T23:17:50.724Z", "cvss": 8.1, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.06226, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2016-2123", "title": "CVE-2016-2123", "description": "A flaw was found in samba versions 4.0.0 to 4.5.2. The Samba routine ndr_pull_dnsp_name contains an integer wrap problem, leading to an attacker-controlled memory overwrite. ndr_pull_dnsp_name parses data from the Samba Active Directory ldb database. Any user who can write to the dnsRecord attribute over LDAP can trigger this memory corruption. By default, all authenticated LDAP users can write to the dnsRecord attribute on new DNS objects. This makes the defect a remote privilege escalation.", "references": ["https://www.samba.org/samba/security/CVE-2016-2123.html", "http://www.securityfocus.com/bid/94970", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2123"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.4"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2016-2125", "noindex": false, "published": "2018-10-31T20:00:00.000Z", "modified": "2024-08-05T23:17:50.585Z", "cvss": 6.4, "cvss_vector": "CVSS:3.0/AV:A/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N", "severity": "medium", "epss": 0.09199, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2016-2125", "title": "CVE-2016-2125", "description": "It was found that Samba before versions 4.5.3, 4.4.8, 4.3.13 always requested forwardable tickets when using Kerberos authentication. A service to which Samba authenticated using Kerberos could subsequently use the ticket to impersonate Samba to other services or domain users.", "references": ["http://rhn.redhat.com/errata/RHSA-2017-0495.html", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-2125", "http://rhn.redhat.com/errata/RHSA-2017-0494.html"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.4"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-10919", "noindex": false, "published": "2018-08-22T17:00:00.000Z", "modified": "2024-08-05T07:54:36.241Z", "cvss": 4.3, "cvss_vector": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.02167, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-10919", "title": "CVE-2018-10919", "description": "The Samba Active Directory LDAP server was vulnerable to an information disclosure flaw because of missing access control checks. An authenticated attacker could use this flaw to extract confidential attribute values using LDAP search expressions. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.", "references": ["https://www.debian.org/security/2018/dsa-4271", "https://usn.ubuntu.com/3738-1/", "https://www.samba.org/samba/security/CVE-2018-10919.html"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.16"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-10858", "noindex": false, "published": "2018-08-22T17:00:00.000Z", "modified": "2024-08-05T07:46:46.959Z", "cvss": 4.3, "cvss_vector": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L", "severity": "medium", "epss": 0.04302, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-10858", "title": "CVE-2018-10858", "description": "A heap-buffer overflow was found in the way samba clients processed extra long filename in a directory listing. A malicious samba server could use this flaw to cause arbitrary code execution on a samba client. Samba versions before 4.6.16, 4.7.9 and 4.8.4 are vulnerable.", "references": ["https://www.debian.org/security/2018/dsa-4271", "https://access.redhat.com/errata/RHSA-2018:2613", "https://www.samba.org/samba/security/CVE-2018-10858.html"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.16"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2017-12151", "noindex": false, "published": "2018-07-27T12:00:00.000Z", "modified": "2024-08-05T18:28:16.367Z", "cvss": 7.4, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.04104, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-12151", "title": "CVE-2017-12151", "description": "A flaw was found in the way samba client before samba 4.4.16, samba 4.5.14 and samba 4.6.8 used encryption with the max protocol set as SMB3. The connection could lose the requirement for signing and encrypting to any DFS redirects, allowing an attacker to read or alter the contents of the connection via a man-in-the-middle attack.", "references": ["https://security.netapp.com/advisory/ntap-20170921-0001/", "https://access.redhat.com/errata/RHSA-2017:2790", "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-12151"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.12"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2017-12150", "noindex": false, "published": "2018-07-26T18:00:00.000Z", "modified": "2024-08-05T18:28:16.639Z", "cvss": 7.4, "cvss_vector": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.1317, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-12150", "title": "CVE-2017-12150", "description": "It was found that samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8 did not enforce \"SMB signing\" when certain configuration options were enabled. A remote attacker could launch a man-in-the-middle attack and retrieve information in plain-text.", "references": ["https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03775en_us", "https://security.netapp.com/advisory/ntap-20170921-0001/", "https://access.redhat.com/errata/RHSA-2017:2790"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.12"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2017-12163", "noindex": false, "published": "2018-07-26T16:00:00.000Z", "modified": "2024-08-05T18:28:16.539Z", "cvss": 4.1, "cvss_vector": "CVSS:3.0/AV:A/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.0759, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-12163", "title": "CVE-2017-12163", "description": "An information leak flaw was found in the way SMB1 protocol was implemented by Samba before 4.4.16, 4.5.x before 4.5.14, and 4.6.x before 4.6.8. A malicious client could use this flaw to dump server memory contents to a file on the samba share or to a shared printer, though the exact area of server memory cannot be controlled by the attacker.", "references": ["https://h20566.www2.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbns03775en_us", "https://security.netapp.com/advisory/ntap-20170921-0001/", "https://access.redhat.com/errata/RHSA-2017:2790"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.12"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-1057", "noindex": false, "published": "2018-03-13T16:00:00.000Z", "modified": "2024-08-05T03:44:11.979Z", "cvss": 8.8, "cvss_vector": "", "severity": "high", "epss": 0.1004, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-1057", "title": "CVE-2018-1057", "description": "On a Samba 4 AD DC the LDAP server in all versions of Samba from 4.0.0 onwards incorrectly validates permissions to modify passwords over LDAP allowing authenticated users to change any other users' passwords, including administrative users and privileged service accounts (eg Domain Controllers).", "references": ["http://www.securityfocus.com/bid/103382", "https://www.debian.org/security/2018/dsa-4135", "https://usn.ubuntu.com/3595-1/"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.14"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2018-1050", "noindex": false, "published": "2018-03-13T16:00:00.000Z", "modified": "2024-09-16T23:16:06.670Z", "cvss": 4.3, "cvss_vector": "", "severity": "medium", "epss": 0.06515, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2018-1050", "title": "CVE-2018-1050", "description": "All versions of Samba from 4.0.0 onwards are vulnerable to a denial of service attack when the RPC spoolss service is configured to be run as an external daemon. Missing input sanitization checks on some of the input parameters to spoolss RPC calls could cause the print spooler service to crash.", "references": ["https://usn.ubuntu.com/3595-2/", "http://www.securityfocus.com/bid/103387", "https://access.redhat.com/errata/RHSA-2018:2613"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.14"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2017-2619", "noindex": false, "published": "2018-03-12T15:00:00.000Z", "modified": "2024-09-17T00:45:45.569Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.11109, "kev": false, "exploits": ["exploitdb"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-2619", "title": "CVE-2017-2619", "description": "Samba before versions 4.6.1, 4.5.7 and 4.4.11 are vulnerable to a malicious client using a symlink race to allow access to areas of the server file system not exported under the share definition.", "references": ["https://access.redhat.com/errata/RHSA-2017:2778", "https://www.debian.org/security/2017/dsa-3816", "http://www.securityfocus.com/bid/97033"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.6"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2017-15275", "noindex": false, "published": "2017-11-27T22:00:00.000Z", "modified": "2024-08-05T19:50:16.452Z", "cvss": 7.5, "cvss_vector": "", "severity": "high", "epss": 0.21408, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-15275", "title": "CVE-2017-15275", "description": "Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.", "references": ["https://access.redhat.com/errata/RHSA-2017:3278", "http://www.ubuntu.com/usn/USN-3486-2", "https://www.debian.org/security/2017/dsa-4043"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.13"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2017-14746", "noindex": false, "published": "2017-11-27T22:00:00.000Z", "modified": "2024-08-05T19:34:39.975Z", "cvss": 9.8, "cvss_vector": "", "severity": "critical", "epss": 0.09876, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-14746", "title": "CVE-2017-14746", "description": "Use-after-free vulnerability in Samba 4.x before 4.7.3 allows remote attackers to execute arbitrary code via a crafted SMB1 request.", "references": ["https://www.samba.org/samba/security/CVE-2017-14746.html", "https://access.redhat.com/errata/RHSA-2017:3278", "https://www.debian.org/security/2017/dsa-4043"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.13"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2017-11103", "noindex": false, "published": "2017-07-13T13:00:00.000Z", "modified": "2024-08-05T17:57:57.836Z", "cvss": 8.1, "cvss_vector": "", "severity": "high", "epss": 0.05118, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-11103", "title": "CVE-2017-11103", "description": "Heimdal before 7.4 allows remote attackers to impersonate services with Orpheus' Lyre attacks because it obtains service-principal names in a way that violates the Kerberos 5 protocol specification. In _krb5_extract_ticket() the KDC-REP service name must be obtained from the encrypted version stored in 'enc_part' instead of the unencrypted version stored in 'ticket'. Use of the unencrypted version provides an opportunity for successful server impersonation and other attacks. NOTE: this CVE is only for Heimdal and other products that embed Heimdal code; it does not apply to other instances in which this part of the Kerberos 5 protocol specific", "references": ["https://support.apple.com/HT208221", "http://www.debian.org/security/2017/dsa-3912", "https://support.apple.com/HT208144"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.10"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2017-9461", "noindex": false, "published": "2017-06-06T21:00:00.000Z", "modified": "2024-08-05T17:11:01.276Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.04228, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-9461", "title": "CVE-2017-9461", "description": "smbd in Samba before 4.4.10 and 4.5.x before 4.5.6 has a denial of service vulnerability (fd_open_atomic infinite loop with high CPU usage and memory consumption) due to wrongly handling dangling symlinks.", "references": ["http://www.securityfocus.com/bid/99455", "https://access.redhat.com/errata/RHSA-2017:2778", "https://access.redhat.com/errata/RHSA-2017:1950"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.9"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2017-7494", "noindex": false, "published": "2017-05-30T18:00:00.000Z", "modified": "2025-10-21T23:55:40.089Z", "cvss": 9.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "severity": "critical", "epss": 0.99448, "kev": true, "exploits": ["exploitdb", "metasploit"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2017-7494", "title": "CVE-2017-7494", "description": "Samba since version 3.5.0 and before 4.6.4, 4.5.10 and 4.4.14 is vulnerable to remote code execution vulnerability, allowing a malicious client to upload a shared library to a writable share, and then cause the server to load and execute it.", "references": ["http://www.securityfocus.com/bid/98636", "http://www.debian.org/security/2017/dsa-3860", "https://www.exploit-db.com/exploits/42084/"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.8"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}, {"id": "CVE-2016-2126", "noindex": false, "published": "2017-05-11T14:01:00.000Z", "modified": "2024-08-05T23:17:50.562Z", "cvss": 6.5, "cvss_vector": "", "severity": "medium", "epss": 0.06585, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2016-2126", "title": "CVE-2016-2126", "description": "Samba version 4.0.0 up to 4.5.2 is vulnerable to privilege elevation due to incorrect handling of the PAC (Privilege Attribute Certificate) checksum. A remote, authenticated, attacker can cause the winbindd process to crash using a legitimate Kerberos ticket. A local service with access to the winbindd privileged pipe can cause winbindd to cache elevated access permissions.", "references": ["https://www.samba.org/samba/security/CVE-2016-2126.html", "http://www.securitytracker.com/id/1037495", "http://rhn.redhat.com/errata/RHSA-2017-0495.html"], "fixes": ["2:4.3.11+dfsg-0ubuntu0.14.04.4"], "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}]}], "total": 53, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "samba", "path": "vulns/ubuntu-14.04-lts/samba", "ecosystem": "Ubuntu:14.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2025-10-21T23:55:40.089Z", "early_advisories": [], "license": "You may freely use the PatchFirst selection and our additions (priorities, early warnings, texts, summaries and aggregates) for your own purposes, including internal business use. Resale, commercial distribution and bulk mirroring of this selection or these additions require a written agreement with the operator. Whenever you use or publish the selection or our additions, credit PatchFirst (https://patchfirst.dev/vulns/) with this link to the regional feed page. Original records from open sources remain subject to their respective licenses and terms. These conditions do not restrict your rights to the original data, which you can obtain directly from those sources.", "terms_url": "https://patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "Records are selected, normalized and combined by PatchFirst; summaries and translations may be added. News is credited with a link to the original source in each entry.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Upstream licenses vary; see the source catalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Free public scores; attribution requested (FIRST EPSS, scores generated by Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}